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(54) Title: A PLATFORM INDEPENDENT BINARY INSTRUMENTATION METHOD 



(57) Abstract: Embodiments of the 
present invention provide for platform 
independence, low intrusivencss, and 
optimal memory usage of the binary 
instrumentation process by means of 
employing one procedure (interceptor 
function) implemented in a high-level 
programming language to intercept an 
arbitrary number of functions or blocks of 
code. Each time a function or code block 
needs to be intercepted a new copy of the 
procedure from a provided memory region 
may be associated with the address of the 
function or block of code by means of a 
memory region descriptor and an intercepted 
function address table. Once activated, the 
interceptor function may retrieve its current 
address and, by searching memory region 
descriptors, determine the region the current 
address belongs to; the region's base address 
may then be obtained. A reference to the 
intercepted function address table may be 
fetched from the region descriptor, and an 
index to the intercepted function address 
table may be computed. Finally, the address 
of an intercepted function corresponding to 
the active copy of the interceptor function 
may be read from the intercepted function 
address table. 



Memory Region with Copies of 
Interceptor Function Body 



Intercepted Function Address Table 



24 

\ 



Original function address 



Original function address 



Original function address 



Original function address 



Original function address 



WO 2006/104407 Al I II 1 1 III II I INI II 1 1 II II 1 1 M 1 1 1 1 1 1 1 1 III! I II 1 III 1 1 1 1 1 1 1) 1 1 11 II 1 1 1 II 1 1 



FR, GB, GR, I 1U, IE; IS. IT, LT, LU, MC, NL, PL, PT, RO, 
SE, SI, SK, TR), OAPI (BF, BJ, CF, CG, CI, CM, GA, GN, 
GQ, GW, ML, MR, NE, SN, TD, TG). 

Published: 

— with international search report 



For two-letter codes and other abbreviations, refer to the "Guid- 
ance Notes on Codes and Abbreviations" appearing at the begin- 
ning of each regular issue of the PCV Gazette. 



